The present invention relates to a method for distributing contents, and more particularly digital data such as software, image data, etc. in a state of being recorded on a recording medium such as a CD-ROM, flexible disk, and the like.
In general, the electronic information including software, image, etc., which are called contents, are normally sold with charge in the state of being recorded on a recording medium such as a flexible disk, but there may be cases for the information to be distributed free of charge. In recent years, there may be such method that the contents are first subjected to data conversion (processing) such as compression, enciphering, etc. and the recorded recording medium is at first distributed free of charge, and the data is made fully usable only for one who desires use by giving the information for inverse data conversion. In such case, there may be two cases where the information for inverse data conversion is made free of charge and the case where it is supplied with charge. In any case, the security of such information is required.
Furthermore, in case of sending/receiving the information as above through a communications line, and with charge, naturally it becomes necessary to confirm the identities (authentication) of both parties, and accompanied with it, security of ID, password, etc. is necessitated.
In view of the situation as above, conventionally there has been adopted a procedure as shown for example in the schematic diagram of FIG. 1 or FIG. 2. In any case, a user side apparatus 2 uses a computer system used by a user who desires to utilize the contents, and a server side apparatus 1 uses a computer system of an organization which sells the contents with charge or distributes them free of charge.
Firstly, referring to FIG. 1, an example of the prior art is described. In this example, however, the contents C themselves are not at the user's hand but are transmitted under coded state from the server side apparatus 2 through the communication line 3.
In FIG. 1, in the user side apparatus 1, at first the user himself (herself) inputs the authentication code (hereinafter to be referred to as user ID) UID and a password PWu and transmits them to the server side apparatus 2 through the communication line 3.
In the server side apparatus 2, when the user ID UID and the password PWu are received through the communication line 3 from the user side apparatus 1, a password search unit 21 causes to search the user IDs of plural users stored in an ID/password data base 22 in advance and takes out the corresponding passwords PWc from the registered passwords. And, in the server side apparatus 2, a comparing unit 23 compares the received user's password PWu with the registered password PWc taken out from the ID/password data base 22, to carry out search for coincidence.
In case the two items have agreed as a comparison result by the comparing unit 23, an enciphering unit 24 enciphers the contents C with the registered password PWc, a concatenating unit 25 concatenates the deciphered program P to a enciphered contents E(C, PWc) enciphered by the enciphering unit 24, and have a transmission data P+E(C, PWc) obtained as a result transmitted to the user side apparatus 1 through the communication line 3.
In the user side apparatus 1 which has received the transmitted data P+E(C, PWc), a deciphering unit 11 deciphers the transmitted data P+E(C, PWc) by the password PWc previously inputted by the user himself, and obtains the contents C by the resulting deciphering program P.
Next, referring to FIG. 2, another example of the prior art is explained. In this example, however, the contents wherein the contents C have been enciphered (hereinafter to be referred to as enciphered contents) E(C, Key) per se are distributed to the user under the condition of previously recorded in a recording medium such as CD-ROM, and a key for deciphering is transmitted from the server side apparatus 2 through the communication line 3. In the user side apparatus 1, an enciphered contents E(C, Key) on hand are deciphered by the key transmitted from the server side apparatus 2.
In FIG. 2, in the user side apparatus 1, firstly the user inputs the user's own ID UID and password PWu, along with the contents ID C-ID described in the label of the recording medium such as a CD-ROM which is previously obtained, and have the apparatus transmit those data to the server side apparatus 2 through the communication line 3.
In the server side apparatus 2, when the apparatus receives the user ID UID and the password PWu from the user side apparatus 1 through the communication line 3, the password search unit 21 searches the user ID of plural users stored by previously registered in the ID/password data base 22 and takes out the corresponding password PWc out of the registered passwords. And, in the server side apparatus 2, the comparing unit 23 compares the received user's password PWu with the registered password PWc taken out from the ID/password data base 22 and carries out coincidence detection.
When, as a comparison result by the comparing unit 23, the password PWu received from the user side apparatus 1 coincides with the registered password PWc taken out from the ID/password data base 22, the enciphering unit 24 ciphers a deciphering key corresponding to the contents ID C-ID with the registered password PWc, and the concatenating unit 25 transmits the ciphered deciphering key E(Key, PWc) to the user side apparatus 1 as a remittance data through the communication line 3.
The user side apparatus 1 which received the deciphering key E(Key, PWc) as the transmission data deciphers the deciphering key E(Key, PWc) with the password PWu previously inputted by the user himself to obtain a deciphering key. And, by using this deciphering key, a second deciphering unit 112 deciphers the ciphered contents E(C, Key) already received on hand to give ultimately the contents C.
In any of the above examples, in case the contents C are to be offered with charge, a processing for charging money may be made on the part of the server side apparatus 2 at appropriate timing.
In the first prior art related in the above, because the contents are enciphered with the user's password on the server side and transmitted to the user side, the contents are required to be enciphered on each occasion, and a load of the server side is large. Moreover, because the enciphered contents are transmitted through the communication line, the communication cost becomes large, and further there may be a danger of error during communication to prevent receiving of perfect contents on the user side. Also, as the password is transmitted from the user side to the server side in a plain sentence, there is an apprehension for it to be leaked.
In the second prior art as above, it is necessary to manage the deciphering key in the unit of the contents on the server side. Also, in case this deciphering key has leaked, there is no preventive means, and although the contents per se are enciphered, the recording medium carrying the record is distributed free of charge in advance, and therefore there is an apprehension for the server to sustain a large amount of loss. Also, to the contents to be distributed in advance to the user, information (contents ID) for identifying it is required to be added. Furthermore, as the password is transmitted from the user side to the server side in a plain sentence, there is an apprehension for it to be leaked.